Joplin 3.3.3 Server - Privilege Escalation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/-id t...

Astra Linux – vulnerability in net-snmp

Net-SNMP provides various tools related to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials could use a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable to trigger a NULL pointer dereference. Version 5.9.2 includes a patch. Users...

Astra Linux – Vulnerability in gdcm

There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – vulnerability in wireshark

In Wireshark versions 3.2.0 through 3.2.4, the GVCP dissector could enter an infinite loop. This issue was resolved in epan/dissectors/packet-gvcp.c by ensuring that the offset increments in all scenarios...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

ROOT-OS-ALPINE-318-CVE-2021-33454 CVE-2021-33454 in yasm - Patched by Root

Root has patched CVE-2021-33454 in the yasm package for Root:Alpine:3.18. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2024-3935 CVE-2024-3935 in mosquitto - Patched by Root

Root has patched CVE-2024-3935 in the mosquitto package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-317-CVE-2024-28182 CVE-2024-28182 in nghttp2 - Patched by Root

Root has patched CVE-2024-28182 in the nghttp2 package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-6846 CVE-2026-6846 in binutils - Patched by Root

Root has patched CVE-2026-6846 in the binutils package for Root:Alpine:3.23. Multiple fixed versions available...

Astra Linux – Vulnerability in OpenSSL

Issue Summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact Summary: Attackers may exploit certain server configurations to trigger unbounded memory growth, leading to a Denial of Service attack. This issue can occur in...

Astra Linux – Vulnerability in Wireshark

An infinite loop in the BitTorrent DHT dissector in Wireshark versions 3.6.0, 3.4.0, and 3.4.10 allows for denial of service through packet injection or malicious capture files...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

ROOT-OS-ALPINE-323-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-8926 CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

Edge is dropping older extensions, affecting popular privacy tools

Microsoft is beginning the retirement of Manifest V2 MV2 extensions in Edge this month, with consumer completion targeted for the end of 2026 and managed-enterprise deprecation in early 2027. Microsoft says that change is justified because 95% of the most-used MV2 extensions in the Edge Add-ons...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

EUVD-2026-54864

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-10595

Summary: CVE-2026-10595 affects parisneo/lollms 2.1.0. A path traversal flaw in the SPA catch-all route (backend/routers/ui.py) allows an unauthenticated attacker to read arbitrary server files by manipulating user-controlled paths. The issue stems from directly joining input into a filesystem pa...

CVE-2026-10595

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...